Storage Namespace Isolation for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security in distributed computing systems is inadequate, as users can access unintended storage locations with the correct access key, and incorrect unlocking exposes data, highlighting a need for more robust security measures.
Innovation Solution
Implementing a system with namespaces that map logical block addresses to physical block addresses, requiring a specific access key and namespace identification code for authentication, ensuring only authorized access to isolated data storage areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption using access keys for LBA ranges is implemented, then user authentication is enabled, but security is limited to key storage and transmission security
Solution Approach 1:
The patent segments the storage device into multiple namespaces, each with its own access key and LBA range. This segmentation isolates data from different users into distinct namespaces, preventing cross-user access even if one namespace's access key is compromised. Each namespace acts as an independent security domain, enhancing overall data security without requiring a single complex security protocol for the entire device.
Solution Approach 2:
The patent introduces a namespace identification code as an intermediary between the user and the actual data. Instead of directly accessing data with an access key, users must first authenticate with the namespace ID, which then directs access to the appropriate LBA range. This intermediary layer adds security by preventing direct access to data even if the access key is known, as the namespace ID acts as an additional authentication barrier.
2Ease of operation
If access keys are used to unlock LBA ranges, then user access control is achieved, but incorrect unlocking exposes data to any user
Solution Approach 1:
By dividing the storage device into multiple isolated namespaces, the patent ensures that incorrect unlocking of one namespace does not affect other namespaces. Each namespace maintains its own access control independently, so even if a user incorrectly unlocks one namespace, data in other namespaces remains protected. This segmentation isolates security failures to specific namespaces rather than exposing all data.
Solution Approach 2:
The patent adds a namespace identification code dimension to the access control mechanism. Instead of relying solely on access keys for LBA ranges, the system now requires both namespace ID authentication and access key validation. This additional dimensional layer of authentication prevents incorrect unlocking from exposing data, as the namespace ID acts as a verification layer that ensures the access key is being used in the correct context.
3Productivity
If multiple users share a storage device, then resource utilization is improved, but data isolation between users is compromised
Solution Approach 1:
The patent segments the shared storage device into multiple namespaces, each assigned to different users or applications. This segmentation enables multiple users to simultaneously access the same physical storage device while maintaining logical isolation through distinct LBA ranges and access keys. Each user can fully utilize their allocated namespace without interfering with other users' data, achieving both high resource utilization and strong data isolation.
Solution Approach 2:
The namespace identification code serves as an intermediary that enables multiple users to share the storage device securely. When a user accesses the storage device, the namespace ID directs the access request to the appropriate LBA range, ensuring that each user's data remains isolated. This intermediary mechanism allows efficient resource sharing while maintaining reliable data isolation between users.
Data Source
AI summary
A data storage device in a distributed computing system has physical block addresses that are each allocated to multiple namespaces. To access the data storage device, a host system issues a command to the data storage device that includes an access key and a virtual block address to be accessed. The data storage device converts the virtual block address to a physical block address of the data storage device using a mapping associated with the access key. Access to a physical data block associated with a particular namespace is granted only if an access key for that namespace is provided to the data storage device.